Inspired by the work of Gottesman [1]} on tamper detection, Broadbent and Lord introduced the beautiful notion of uncloneable encryption [2]}. This notion is an encryption scheme that has the following attractive feature: given any encryption of a classical message \(m \in \lbrace 0,1\rbrace ^*\) , modeled as a quantum state, the adversary should be unable to generate multiple ciphertexts that encrypt to the same message. Formally speaking, the uncloneability property is modeled as a game between the challenger and the adversary. The adversary consists of three algorithms, denoted by Alice, Bob and Charlie. The challenger samples a message \(m\)  uniformly at random and then sends the encryption of \(m\)  to Alice, who then outputs a bipartite state. Bob gets a part of this state and Charlie gets a different part of the state. Then the reveal phase is executed: Bob and Charlie each independently receive the decryption key. Bob and Charlie – who no longer can communicate with each other – now are expected to guess the message \(m\)  simulatenously. If they do, we declare that the adversary wins this game. An encryption scheme satisfies uncloneability property if any adversary wins this game with probability at most negligible in the length of \(m\) . Note that the no-cloning principle [3]} of quantum mechanics is baked into this definition since if it were possible to copy the ciphertext, Alice can send this ciphertext to both Bob and Charlie who can then decrypt this using the decryption key (obtained during the reveal phase) to obtain the message \(m\) .
